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INTELLIGENCE COMMUNITY (IC) REACH 

TEAM {Cl! REL TO USA, FVEY) 

(Submitted by the SID Technical Director) 



(C//REL TO USA. FVEY) ICREACH is an NS A information-sharing initiative for 
customers and analysts across the Intelligence Community overseen by the Director from 
concept to implementation. This team began over two years ago w ith a basic concept 
compelled by the IC's increasing need for communications metadata and NSA’s ability to 
collect, process and store vast amounts of communications metadata related to worldwide 
inteliigence targets. The ICREACH team delivered the first-ever wholesale sharing of 
communications metadata within the U S. Intelligence Community. The SID team did 
considerable w ork w ith NSA/OGC (Office of the General Counsel) and SID Policy to 
ensure appropriate legal and policy approvals for this new technical capability. In 
addition, the team briefed the Second Party partners on this effort to set the stage for 
Second Party participation in ICREACH. Their efforts hastened implementation of this 
much- needed capability. 
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(S//REL TO USA. FVEY) Provide IC analysts with access to a wider set of shareable data through the 
ICREACH Application, ICREACH allows IC analysts the ability to perform more comprehensive analy ses 
for situational awareness and target development in support of their mission objectives. 



(S//SI//REL TO USA, FVEY) Expand and grow [C access to Digital Network Intelligence metadata via 
ICREACH to aid and assist in target development and situational awareness against computer based targets, 

(S//SI//REL TO USA, FVEY) Transition ICREACH services to NSA/CSS’ cloud architecture. This will 
provide the opportunity for increased dissemination of SIGINT data and data enrichment services tailored 
to meet customer mission needs. 

(S//REL TO USA s FVEY) Respond to the National Intelligence Priorities Framework (NIPF) updates; 
expand the capabilities of the National S1GINT Requirement's Process (NSRP) and the new/modified INs 
as required by US SIGINT Consumers (i.e. IC. DoD, Policy Makers, Other Government Agencies). This 
will allow NSA/CSS to better support the broad goals of ODNI for Mission Management and Information 
Sharing with the US SIGINT Consumers, and facilitate the ability to obtain SIGINT from NSA/CSS. 
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Sharing of Information 
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1. (U) Recommendations of 9/11 and WMD 

Commissions 



2. (U) Congressional Interest - IRTPA 

3. (U) DNI - A part of 1 00-Day Plan 

4. (U) DoD Information Sharing Strategy 
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• (U//FOUO) DCID 8/1 , June 2004 - "All IC agencies will 
provide intelligence information at the earliest point at 
which customers can understand and effectively use it to 
support their mission objectives../" 



• (U//FOUO) NSA Policy 1-9, May 2005 - implements DCID 
8/1 and Transformation 2.0: "SIGINT information originated 
by NSA/CSS shall be shared ... with U.S. Government 
customers and partners ... and with Foreign Partners... to 
the maximum extent possible, consistent with applicable 
statutes, executive orders and regulations, and consistent 
with the need-to-know ? principle and with applicable 
authorities governing the protection of intelligence 
sources and methods.” 
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Minimized 


Assessed 
for FI 


Shareable 


SIGINT Products & 
Services 


Yes 


Yes 


Yes 


SIGINT 

Communications 

Metadata* 


Yes 


No, but 
provided for 
FI purposes 


Yes 


Raw SIGINT 


No 


No 


No 



*{C//REL} Communications metadata refers to structured “data about data”: it includes all information associated 
with, but not including content, and includes any data used by a network, service, or application to facilitate routing 
or handling of a communication or to render content in the intended format; it includes, but is not limited to; dialing, 
routing, addressing, or signaling information and data in support of various network management activities {e.g. 
billing, authentication or tracking of communicants). 
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(C//REL) Ensure efficient, effective sharing of ever expanding volumes of 
1C communications metadata. The 1C requires access to a much 
greater volume of data, for a larger number of analysts. 



1 . Make more data accessible 

2. Wider set of 10 Analysts 

3. For more comprehensive in-depth 
analysis of Communications 
Metadata for 

• Situational Awareness 

• Collection Management 

• Target Development 
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Proposal 
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PROPOSAL: 

1 . (U//FOUO) Make 1C communications metadata accessible to the 
greater 1C. 

a. Data will be updated and accessible instantly by 1C Intelligence 
analysts. 

b. Data will be provided for foreign intelligence and counter- 
intelligence purposes. 

c. Data sources and methods can be protected. 

d. Data will be minimized* according to each agency’ s standards 

(e.g. NSA’ s data will be minimized to NSA minimization 
standards, CIA’ s data to CIA minimization standards, etc.). 

* Minimize: 

(U//FOUO) specific procedures to minimize the acquisition and retention, and prohibit the dissemination, of non- 
publicly available information concerning unconsenting U.S. persons consistent with the need of the U.S. to 
obtain, produce and disseminate foreign intelligence information. 
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Proposal 






2. (S) Handles the ever increasing volumes of communications 

metadata (est. 2-5 billion records/day) 

3. (S) Incorporates all communication types - telephony and all forms 

of digital, e.g. e-mail 

4. (U) Allows for the expansion of communications metadata fields 

and sources 

5. (U) Accommodates multimedia (voice/data/video) convergence 

6. (U) Allows for greater access by U.S. DoD military elements 

7. (U) Requires only JWICS account plus PKI 

8. (S//NF) Does not necessarily replace CrissCross/Proton 

9. (C) Allows for incorporation of foreign partner data* 

* As negotiated 
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Use of ICREACH 
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(S//REL) ICREACH is a one-stop 
shopping tool for consolidated 
communications metadata analytic 
needs. Through ICREACH, analysts 
can access most tools and all 
appropriate data sets related to both 
telephony and DNI data with a single 
login. 
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Use of ICREACH 
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Current Status: 



(S//REL) ICREACH is an evolving NSA toolkit (middleware) 
focused on analyzing the target in a converged telephony-DNI 
environment. The federated query searches across all data sets 

for information relating to a target identifier. 

(S//SI//REL) For example, through ICREACH an analyst could 
find all metadata comms related to a target: phone number, 
Global Mobile Satellite and cellular events and selectors, 
email address, etc. and any associated locational information. 
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1 . (U) Certify Users 

2. (U) Train Users 

3. (U) Grant Access to 
Users 
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ICREACH Certification 




* 



1 . (U//FOUO) Who can be certified? Any individual who: 

a. requires access in support of Agency X mission (as 
validated by Agency X POC) 

b. is a part of the U.S. IC 

c. holds TS/SCI 

d. has PKI 

e. is an IC-intelligence analyst (of any sort) 

2. (U//FOUO) PKI-enabled accounts will be accessible 

via JWICS. 
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ICREACH Training 



■Smbd* 





1 *r£i 




* 


I’-iC-S 


I-- 1C Ft 


r lt-ics 


ric-e 



(U//FOUO) NSA will train a cadre of individuals from each agency 
who will then go back and train their own users. 



(S//SI//REL) Training consists of: 



a. Intro to communications metadata to familiarize users with PSTN*, 

cell phones, email, IMSIs**, etc. 

b. Course to familiarize users with ICREACH tool. 



c. Intelligence Oversight training, including minimization. 

d. Limitations on use of communications metadata 

for operational purposes. 

* PSTN = Public Switched Telephone Network 

** IMSI = International Mobile Subscriber Identity 
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1 . (U//FOUO) Agency X POCs to approve accounts for 

individuals. 

2. (U) Accounts expire after three (3) months of 

inactivity. 

3. (U) Users re-apply and are re-certified annually. 
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Intelligence Oversight 




* 




(U//FOUO) Approval authorities and auditors at each agency will 
conduct the requisite oversight training and then conduct 
independent oversight. 



2. (U//FOUO) Auditing of agency personnel will be conducted by each 

agency. ICREACH audit records will be pushed by NSAto each 
agency in order to perform that task. 



3. (U//FOUO) Access will be terminated immediately upon identification 

of any violation and will be reinstated only upon re-certification by 
the agency approval authority. 



4. (U//FOUO) NSA will perform random auditing of IC-wide users to 

ensure compliance across the 1C and notify Agency X of any non- 
compliance. 
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(S//NF) Call Events in PROTON 






•Total Call Events in NSA PROTON* est. 149 Billion 
Of those: 

•Total Call Events Non-NSA est. 101 Billion 

•Total Call Events Non-NSA, est. 92,000 

Non-NOFORN, Non-HCS 



1 % 




99% 



□ Non-NSA Events NOT Shareable 
with 5 Eyes (NOFORN / HCS) 



B Non-NSA Events Shareable with 
5 Eyes (Non-NOFORN / Non-HCS) 



* For date range 2000-2006, as of early July 2006; some 
data has been aged off system 
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Current NSA Communications Metadata Holdings 
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(S//SI//REL) ICReach will share over 850 billion NSA event records at IOC 
with an additional 1 -2 billion records added daily 



Telephony ( 1999-Apr ' 07) 

Total Call Events est. 711 Billion 

Total Call Events from est. 126 Billion 

2 nd Parties 



DNI (20 04- Apr *07) 

Total Events est. 143 Billion 
No DNI yet from 2 nd Parties 



Call Events 




1999 2000 2001 2002 2003 2004 2005 2006 Jan- Feb- Mar- Apr- 

07 07 07 07 

Yearly Totals 



DNI Events 




2004 2005 2006 Jan-07 Feb-07 Mar-07 Apr-07 

Yearly Totals 
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Large Scale Expansion of NSA Metadata Sharing 



5*711 L* 



(S//SI//REL) Increases NSA communications metadata sharing 
from 50 billion records to 850+ billion records (grows by 1-2 billion 
records per day) 




□ Projected DNI 
■ DNI 

□ Projected PSTN 

□ PSTN 



*( C//REL ) Includes Call Events from 2 nd Party SIGINT Partners (est. 126 Billion 
records) 
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ICREACH 






(S//NF) NSA populates these fields in PROTON: 

• Called & calling numbers, date, time & duration of call 



(S//SI//REL) ICREACH users will see telephony metadata* in the following fields: 



DATE & TIME 

DURATION - Length of Call 
CALLED NUMBER 
CALLING NUMBER 

CALLED FAX (CSI) - Called Subscriber 
ID 

TRANSMITTING FAX <TSI) - 
Transmitting Subscriber ID 

IMSI - International Mobile Subscriber 
Identifier 

TMSI - Temporary Mobile Subscriber 
Identifier 



IMEI - International Mobile Equipment 
Identifier 

MSISDN - Mobile Subscriber Integrated 

Services Digital Network 

MDN - Mobile Dialed Number 

CLI - Call Line Identifier (Caller ID) 

DSME - Destination Short Message 

Entity 

OSME - Originating Short Message 

Entity 

VLR - Visitor Location Register 
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ICREACH 






(S//SI//REL) ICREACH telephony metadata fields (con’ t): 



MCC - Mobile Country Code 

MNC - Mobile Network Code 

LAC - Local Area Code 

CELL ID - Serving Cell Identification 

TIMING ADV - Timing Advance Value 
(distance from base transceiver) 

LAT/LONG - Latitude/Longitude in 

degrees and minutes 

CALLING FTIN - Forward Terminal 

Identification Number 



CALLING RTIN - Reverse Terminal 

Identification Number 

DIALED NUMBER 

FWD SIM - Forward Subscriber 

Identity Module 

REV SIM - Reverse Subscriber 

Identity Module 

MES TYPE - Message Type 



(S//SI//REL) ICREACH users will also see this DNI metadata: 

Email addresses Chat handles Date & Time Protocols 
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Metadata Field 


PSTN 


INMARSAT 


PCS 


DNI 


Date 


X 


X 


X 


X 


Time 


X 


X 


X 


X 


Duration 


X 








Called Number 


X 








Calling Number 


X 








Called Fax number 


X 








Transmitting Fax number 


X 








IMSl 






X 




TMSL 






X 




IMEt 






X 




MSISDN 






X 




MDN 






X 




CLI 






X 




DSME 






X 




OSME 






X 




VLR 






X 




MCC 






X 




MNC 






X 




LAC 






X 




Cell ID 






X 




Timing Advance 






X 




Lat/Long 




X 


X 




Calling FT IN 




X 






Calling RT1N 




X 






Dialed Number 




X 






Forward SIM 




X 






Reverse SIM 




X 


X 




Email Address 








X 


Chat Handle 








X 


Protocols 








X 
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ICREACH Log-in 
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Federated Query Account Info Logoff 



a 



ij'EQii.KAl.U.L) (^UEKY HUMA'IAKY 
Query | Results | Feedback | Help | What' 
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Save A . s |Tcxt H Saw | 

Yuur qutiry myLuhtiul ryuurdy in Lhy fLilluwiriu| d aL aba y uy . 
Click on the selector to view its expanded results. 
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'As ICREACH evolves, IC partners may wish to develop their own brokers, as 2 nd parties are doing 
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• (C//REL) ICREACH is a large scale expansion of communications metadata 
shared with IC partners 

• (C//REL) Enables federation of community metadata across IC agencies 

• (C//REL) Makes greater use of NSA r s communications metadata which is 
information about content (but not the content itself) 

- Definition: Information used by networks, services, or applications to route 
communications or make the content usable including: 

• Dialing, routing, addressing, location, or signaling data used for network management 

• Formats and protocols used to render the information for people and systems 



* (S//SI//REL) Expands NS A sharing in three dimensions: 

- Includes more modes of communications (PSTN, INMARSAT, PCS, DNI) 

- 5x increase in types of metadata shared (from 5 fields to 33 fields) 

- 12x increase in volume shared (from 50 billion to 800+ billion records) 



SECRET //COMINT //REL TO USA, FVEY//20320108 








■ 2 * !!*□£, 



<f$i Til' 'r^i '*»i <HM‘ <!*l ':$i 'NSi '^i ■ r*S <rti 
‘ l( ■£" 1C "fii.lC "5 ■■■' , ' '■ " '■ ■"' ‘■'■J ■•■•j i-te^TC^O ~ \Q "j 

Oil" ' 



UNCLASSIFIED//FOR OFFICIAL USE ONLY 

ZmuuTr 



•tei- 1 r#i <?#i itei >r#i' »r*i- • :*S ■ 'tei* 'tei iter « :-ii* 'ter 'tel *tei' <ter 'ter 'tei *tei 1 :^»i iril» >rtr iSI* *te' 'Mi- 'ter 'ter 1 wM 'lii 'tei irST* 'ter «ter 'tei <tei «ter 'tei *te 'tei 'ter «tei iter 'ter * tel 'tei •: 'tel 'ter "tei^M 

tic iff: ic-te" irS’ i&te" iC’te" icte" n ■-■ ic *9 * ic te“ ic j & = Kte“ ic-te" ic p t- irft- ic ■$ * n 'f n te *' n te* ic te * ic te “ n ^ ic ttr- ic te ■ ic m t m ic te" irt’ ic’t* Kte" ic^fl 1 ic'S'icfi 1 i&te' ic-o^c-s* w. n 'fl* tei*i ic^' nf ic ■* ■ i&cfrn&cfrnfrn&cttJiftitoc 

. — ._,_ 

f-'zJL . , 

•s' 



• (U) Pilot development underway - IOC June 

• (U) CCP Funded for first year 

• (U//FOUO) Agreements on 2 nd Party sharing (bi- 
directional) 

• (U) Expansion to open source? 

• (U//FOUO) Limitations and responsibilities related 
to operational use 

• (U) Software licensing 
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(S//NF) From date of sponsorship: 



Train the trainers 
Account Set-up 

Scrub PROTON NOFORN data for release to ICREACH & Second Parties 
Establish ICREACH Configuration Control Board (CCB) across 1C 

(U//FOUO) 2008: 

Reach out to other databases 
ICREACH Enhancements 
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ICREACH Timeline 















(U//FOUO) 2005 

• Fall: initiative conceptualized 

• Dec: informally proposed to CIA DIR who suggests staffs meet to 
discuss it and consider other options before submitting to DNI 

(U//FOUO) 2006 

• Spring-Summer: discussions with policy reps & technical experts from 
several U.S. IC agencies; broached with Second Parties 

• Summer-Fall: briefed Program Manager/Info Sharing Environment, 
ODNI/CIO/Info Sharing & Customer Outreach, & ODNI/CIO/IC Enterprise 
Architecture 

• Oct: formally proposed to DNI 

• Late Nov: interim response from DNI, recommending we continue 
working initiative with ODNI/CIO & DDNI/Collection 

(U) 2007 



May: Pilot development begins 
June: Pilot IOC 
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ICReach Deployment 1 Schedule 
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(S//REL) ICREACH requires between $2.7M and $3.9M in FY07 to implement the 
initial phase, depending on the pace of the development effort. 



FY2007 



Following Sponsorship 30 days 



60 days 



*H) days 



120 days 



ISO days 




Phase 1 

* Establish IT and training POCT s across the 

IC 



2.0 




3.0 
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* Add DNI and other NSA data sources (e.g., 
PCS, GNDB) to Federated Query Service 

* PKI Validation and Acct Establishment 
Process 

* Design User and Metadata Use Training 
Course 



Phase 3 

* Transition and Integrate ICR to 
Operational Hardware 

* Initiate User training sessions (Final 
schedule & staffing requirement: TBD) 



Phase 4 and out years 

* Develop interface with IC data 
sources and brokers 

* Enhancements to improve 
analytic tool integration 



Phase 2 

* Code and Test User Interface (Ul) and 
Web Service 

* Test Account Authentication and 
Security for User Interface 

* Conduct “Train the Trainer'" for Ul 
and Account Management process 



Phase 3.1 

* Optimize hardware 
performance 
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Deployment 1 Life Cycle Support 

* Estimated Life Cycle (per year: 1- 5) = $2.5 - 4.5M 
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ient 1 Activity 




3.1 



• Develop interface with 1C data sources and brokers 

• Second Party Brokers (as made available) 

• PROTON Data Broker 

• Other 1C Agency Data Brokers 

• Enhancements to improve analytic tool integration 



Resources 

1 FTEUSGPM 

.25 FTE Account Access 

1.0 FTE GUI 

.5 FTE Web Service 

.5 FTE Config Mgt and Test 

1.0 Training Development 

.5 Database Engineer/Admin 



Estimated NRE Cost 

4.75 FTE =$1.350M 
Hardware = TBD 
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(C//REL) ICREACH: Sharing SIGINT Com ms Metadata with the Intel 
Community 

FROM 

Tech Director, Target Analysis Center (SSG1) 

Run Date: 09/27/2007 



(C//REL) Remember when you were little and your mom always told you it was nice to share? I don't 
know about you, but sometimes in the intervening years it seems we forget about that little axiom. 
Recently those of us who are members of the Intelligence Community (IC)have been advised that we 
have to do a lot more sharing. Congress has told us, the 9/11 and WMD 1 Commissions have reminded 
us, and the Department of Defense strategy for improving operations insists on information sharing. 
While NSA has been sharing information for years through tailored product reporting, write-to-release 
efforts, ELINT 2 metadata and tearline reporting, we are now going a step beyond that and are actually 
sharing SIGINT communications metadata through a program called ICREACH. 

(S//REL) ICREACH intends to make more metadata accessible to our Intelligence Community brethren 
primarily for the purposes of situational awareness and target development. This COMINT 3 metadata is 
not to be used for targeting; instead provisioning of the metadata to IC intelligence analysts should 
foster greater collaboration on targets of interest. Like NSA's internal tool, GLOBALREACH, 
ICREACH is a one-stop shopping tool for consolidated communications metadata analytic needs. 

(S//REL) Through ICREACH, IC analysts can access all appropriate data sets related to telephony (and 
eventually DNI 4 data) with a single login. The IC intelligence analysts will be validated by the 
ICREACH point of contact from their particular agency, must be part of the U.S. Intelligence 
Community, must hold a TS//SI clearance and must have a PKI certificate in order to access the data 
through JWICS 5 . Each person will be provided an account only after their need for it is verified by the 
Agency POC and diey have received training on the tool, the procedures, and the technologies 
represented in the metadata. 

(S//SI//REL) For the first time, IC intelligence analysts will have immediate access to SIGINT 1st Party 
metadata as soon as the data is loaded in the centralized metadata repository. The FASCIA Call, PCS & , 
and INMARSAT tables will be die first ones accessed in the ICREACH Beta release, now being piloted 
by a very limited number of IC analysts 7 . Reference data from odier NSA projects lice 
ASSOCIATION . TAPERLAY . and CONTRA OCTAVE is also queried. If the number is tasked in 
OCTAVE, a simple "yes" is returned with the event data. 

(S//SI//REL) Responses dius far from the beta testers have been largely positive widi some very 
interesting questions, comments, observations and suggestions being provided, considered, and where 
possible, implemented. Future plans call for a rollout to additional IC agencies and Unified Commands 
(DIA and STRATCOM 3 are next on the list for training) and access to other sources of metadata. NSA 
and CIA are developing an interface to enable access to their metadata through 
ICREACH/GLOBALREACH so that there is a reciprocal exchange of information. 

(U//FOUO) If you have questions on ICREACH, you may direct them to the following individuals: 

• For questions about the rollout of ICREACH to the next sets of users:^^^^^^^Hsi, 






For questions about the data available within ICREACH: 



SSG1 >mKKKII^M 

For questions about the technical workings of ICREACH: 
from SSG13. 

(U) Notes: 

1. (U) WMD = Weapons of Mass Destruction 

2. (U) ELINT = Electronic Intelligence 

3. (U) COMINT = Communications Intelligence 

4. (U) DNI = Digital Network Intelligence 

5. (U//FOUO) JWICS = Joint Worldwide Intelligence Communications System, operated by the 
Defense Intelligence Agency (DIA) and serving the DoD and IC. 

6. (U) PCS = Personal Communications Services 

7. (C//REL) The IC analysts participating in the pilot are from the Special Operations Command 
(SOCOM), CIA, Central Command (CENT COM), and the National Counterterrorism Center 
(NCTC). 

8. (U) STRATCOM = Strategic Command 







7. NSA: for the foreseeable future, MSA has two separate definitions of what 
constitutes content based on EO 1 2333 and FISA/PAA collection. FISA considers 
communications data to be part of the content of the communication, hence FISA has 
no separate concept of metadata. All discussions at the conference were therefore 
focused on “standard” collection under the authority of EO 12333. 

8. There is a constitutional expectation of privacy within the US. For 
communications data this is harder to quantify than for content. New procedures will 
permit a differentiation between content and communications data allowing for far 
greater data usage and advancing other related changes. A tension remains 
between the desires to minimise shared data containing US identifiers, and engaging 
more openly to support the foreign cryptologic mission. 

9. It is harder to define what constitutes a US identifier with DNI data ■ where unclear 
it is treated as US. NSA is moving from minimised records within their databases to 
minimising identifiers within reports. Sharing unmasked US identifiers with second 
party SIGINT partners will be easier than with some US domestic partners. 

1 0. All: All SIGINT agencies seek to protect their equities, especially relating to 
Special Source Exploitation (SSE.) 

1 1 . Special categories of data were considered in the context of their potential to 
contribute to pattern of life analysis. An increasing amount of new data types are 
available to SIGINT agencies, some proving difficult to categorise as either content or 
communications data. The conference agreed to step back from trying to categorise 
the data and simply to focus on what is shareable in bulk. 

1 2. Consideration was given as to whether any types of data were prohibited, for 
example medical , legal religious or restricted business information, which may be 
regarded as an intrusion of privacy. Given the nascent state of many of these data 
types then no, or limited, precedents have been set with respect to proportionality or 
propriety, or whether different legal considerations applies to the “ownership” of this 
data compared with the communications data that we were more accustomed to 
handle. It was agreed that the conference should not seek to set any automatic 
limitations, but any such difficult cases would have to be considered by “owning” 
agency on a case-by-case basis. 

(comment: NSA normally considers any target data (pattern of life or other) that can 
be characterized as “foreign intelligence” as proper for collection, analysis and 
production. 



35. (d) ICREACH: Sstill a pilot this provides minimised DNR data to Sigint-cleared 
and appropriately trained analysts across the US Intelligence community. Second 
Party derived data is currently not made available to US Intelligence Community 
f 1C) fdomestic)d em#$fe agencies (although GQSB has agreed that theier DNH 
metadata may be shared), but such data would be valued In the hope that such 
agreement will be forthcoming, NSA has persuaded other US 1C agencies to make 
almost 1 00 bn previously NOFORN records shareable with the 5-eyes via GLOBAL 
REACH. VoIP is treated as DNR though with only DNR records and fields shown to 
analysts. Making DNI available through ICREACH is currently restricted due to 
limited automated (general counsel approved) methods to provontod by US po li cy on 
minimize DNI metadata. atteft. 



36. ‘Deconfliction’ is not formalised through ICREACH. Query records can potentially 

be used to alert analysts that other analysts are looking at the same data. 
Deconflicting operations remains a tough challenge requiring increased coordination 
of operations and collaboration. 

37. There is interest in the relationship between the implementation of A-SPACE (a 
U.S. DNI initiative to link all U.S. 1C analysts to common tools, and sharable 
databases and allow for greater collaboration) and ICREACH inasmuch as it may 
affect Second Parties’ internal procedures and access issues with domestic 
agencies. 

38. (e) U.S. IMSCID5: This is a specific method of NSA providina shar i no uniminimized 
SIGINT data to CIA (as if CIA had collected it itself) i n support of the latter’s 
operational mission ^ and d Data from Second Parties is shared with CIA in 
accordance with special agreements between NSA and each second party . 

39. GCHQ are employing methods (a) and (b). For military SIGINT needs GCHQ 
uses GCO’s 1 to reach back to UK and 5-EYES repositories. The military’s work 
within the ambit of the National SIGINT Organisation comes under the authority of 
GCHQ. 

40. NSA shares US SIGINT data with all US SIGINT elements that operate under 
DIRNSA’s operational control . ag e nc ies. With Second Parties there is an initial 
minimisation of the data when possible: however all second parties have agreed to 
abide by U.S. minimization criteria.? Ffor US intelligence agencies NSAmustte ere-ia 
further minimize sing of the data , before sharing and for other US agencies (such as 
law enforcement) NSA only provides data under its technical support” mission. 
Currently, all such data is minimized before sharing t horo i s another, further l eve l of 
m i n i m i s i ng of data (most restricted data set.) 
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UNITED STATES GOVERNMENT 

memorandum 

TAC-0xx-05 



DATE: 06 July 2005 

REPLY TO ATTN OF: TD/TAC 

SUBJECT: Sharing of MetaData across the IC — Dissemination of SIGINT Metadata 
Beyond NS A 

(FOUO)- MEMORANDUM OF UNDERSTANDING 
TO: DIR 

THRU: D/DIR ,IG ,OGC ,DK ,ITD , SE , NCR CIA , 

D/S ID ,S02 ,S l S2 ,S3 

REFERENCES: A. (C) Request for additional NS A data for CIA’s PROTON 

Program, (dtd: 10 Mar 2005) 

B. (C) Minimization Plan for the Application of CRISSCROSS 

Analytical Software to NS A SIGINT Acquired Telephone 
Call Control Data, dated 20 Jan 1999. 

C. (C) MOU between NS A and FBI for Access to NS A Data in 

the CRISSCROSS Program, dated 19 Jan 2001. 

D. (C) MOU between NS A and DIA Regarding the 

CRISSCROSS Program, dated 19 Jan 2001 . 

E. (U) NS A/CSS Policy 1-9, Information Sharing , dated 26 May 
2005 . 



PURPOSE: (U) To establish the DIRNSA/CHCSS and NS A/CSS as the U.S. IC 
Executive Agent for IC-wide metadata sharing. 

BACKGROUND: 

(S//NF) Except for a few' point to point sharing initiatives, CRISSCROSS/PROTON is 
the current IC (plus) information sharing structures. CRISSCROSS/PROTON is a CIA- 
managed program w'hich provides extracts from selected Agency (NS A, CIA, DIA, FBI 
and DEA) databases of telephone call records and reference data obtained from 

Derived From: NSA/CSSM 1-52 

Dated: 20041 123 
Declassify On: 20300707 
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HUMINT, SIGINT, Open and law enforcement related sources to analysts in U.S. law 
enforcement and intelligence communities at a CONFIDENTIAL NOFORN level. The 
key data elements are stored and retrieved for display by the PROTON Interface include: 
called and calling telephone numbers, date, time, and duration of calls. 

(S//NF) For approximately the last 5 Vi years, the CIA CRISSCROSS (now PROTON) 
program has been incorporating NSA provided SIGINT-derived (U.S. and Second/Third 
Party) data. NSA provides this information to CRISSCROSS/PROTON Agencies for 

(S//NF) The decision to disseminate SIGINT-derived signaling outside COMINT 
Channels also had _policy and operational dimensions. Tests have demonstrated that 
SIGINT- derived and traditional HUMINT-derived call record data can be stored and 
displayed in a manner which makes them appear to be indistinguishable, which in general 
terms make the risks to sources and methods approximately equal. However, under some 
circumstances, e.g., signaling data form a unique target area, which could have come only 
from a sensitive SIGINT source, dissemination of data to CRISSCROSS would be 
ina p pro priate . This is the case when the data also includes information elements that are 
only available and could only come from exploitation of signaling. The MOA is silent on 
this point, leaving to NSA full decision authority to decide which data to provide and not 
provide. 

(C) For several years prior, NSA had been providing SIGINT-derived signaling 
information to CIA and DEA to support multi-agency counter narcotics analysis, as 
approved by DDO, OGC, and the Office of Policy . Calling data from several Latin 
American collectors, and from Thailand, had been of great value to the DEA and to the 
DC I Crime and Narcotics Center, and there were no adverse operational or legal impacts 
to NSA. 

(S//NF) Operationally, the flow of large volumes of intercepted signaling data 
could place additional burden onNSA's IT infrastructure. While, as above, the MOA did 
not address IT infrastructure, NSA retained full discretion over volume and timing of 
information flow, even as NSA chose to support the CRIS SC ROS S/PROTON program 
with certain SIGINT inputs. 

(S//NF) Requisite human and communications resources are in place in SID to 
support the transfer of moderate volumes of signaling-derived call record data to the CIA 
CRISSCROSS/PROTON Program Office. No increase in personnel was required to 
initiate data flow. Under the terms of MOA, CIA provided the list of US overseas 
commercial phone numbers to be minimized in NSA processing of signaling data. 
Similarly, the Department of State and Department of Defense telephone directories will 
be researched by NSA to identify official US government overseas phone numbers in 
order to minimize call records associated with them. To this end, the NSA 
CRIS S C ROS S/PROTON Program Manager agreed to obtain the DOS and DOD 
directories annually and, with CIA assistance, extract the overseas numbers . That 
function was transferred to the Communications Event Analysis Center (CEAC), in S2S, 
in 2(K)4. The software to extract call record data and to support minimization exists on a 
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server under S2S control. A huge volume of signaling data (-400M records) flows to that 
server on a daily basis to meet NS A analytic needs, and sufficient communication 
bandwidth is currently available to support the transfer of processed call records (~37M 
pei' day) to CIA's CRISSCROSS/PROTON Program for reformatting. We anticipate S21 
will continue to be responsible for loading CIA CRISSCROSS/PROTON output on 
NSA's CRISSCROSS/PROTON ser ver, and CEAC will continue to be responsible for 
maintaining minimization and audit controls on all-source data received from CIA. 
Finally, SID Office of Oversight and Compliance would be responsible for oversight of 
USSID 18 compliance. 

(S) Community analytic interest in dialing analysis continues to grow' and is 
directed at discovery of new' specific targets or topics, and demand for additional call 
record volume to support contact chaining and geolocation has increased. Signaling links 
are competing for collection priority just like any other potential SIGINT target. As with 
other targets, the potential to expand collection is limited by available resources, to 
include field processing of signaling links as well as bandw'idth to support forwarding 
from collection sites to NS A. 

(S//NF) The CRISSCROSS program, in which NS A already participates as a user 
of data, has had notable successes since its inception in 1990, such as enabling major 
narcotics arrests, monitoring Rainsi Yousefs colleagues, unraveling the Mubarak 
assassination plot, and providing insight into Pakistani nuclear weapon test activities. The 
program has received high marks from senior Community levels, such as the PFIAB, and 
Assistant DCFs for both Collection and Production. CRISSCROSS was also cited in the 
report by Admiral Jeremiah on Indian nuclear testing as a potential improvement to 
Community analytic strength. Since 9/1 1, the contributions to the GWOT due to our 
increased collection of signaling metadata are innumerable and significant. It is safe to 
say that it has been a contribution to virtually every successful rendition of suspects and 
often, the deciding factor. Hence the benefit to the intelligence and law enforcement 
communities of any S IGINT-augmented inputs could be considerable, as SIGINT has the 
potential to access a broad range of targets. 

CURRENT PROPOSAL: (S//NF) Ref A. requests additional data elements from 
SIGINT collection be included in the data set transferred to PROTON. Specifically, they 
want mobility management information relating to digital cellular and mobile satellite 
systems to include Global Cell ID's, Location Area Codes, spot beams, International 
Mobile Subscriber Identifications, International Mobile Equipment Identifications, 
Latitude/Longitude, and Inmarsat Return ID's. They also requested content from Short 
Message Service exchanges (w'hich we are required to audit queries against). 

DISCUSSION: (S//NF) The current data push to CIA/PROTON is roughly 40 
Million records per day which has resulted in approximately 30% of the PROTON data 
set ( 1 996-2005) coming from SIGINT sources (2002-2005). The addition of the 
requested data elements w'ould more than double the volume of data sent to PROTON on 
a daily basis. This w ould increase the percentage of SIGINT contribution to PROTON 
significantly. CIA is positing PROTON as the community resource for target/lead 
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development based on contact chaining techniques. In this regard it is extremely difficult 
to envision it playing that role at NS A. PROTON requires a NOFORN/ORCON access, 
must be licensed, has no API that would allow access integration with other tools (E.G. 
Federated query) and, represents a significant funding investment and dependency on a 
CIA contractor. 

RECOMMENDED RESPONSE: (S//NF) In the context of the atmosphere 
created by the events of 09/1 1/01 and the following investigations into the perceived 
'intelligence failure’ a recurring theme has been the lack of data sharing on the part of the 
IC members . Against that background, it is difficult to deny requested access to SIGINT- 
only datasets that are thought to have value to other intelligence analysts/missions. In an 
effort to: 

a. ) provide access to the requested data and, 

b. ) break new ground in the information sharing arena while, 

c. ) not moving any more data out of NS A and into duplicative storage. 

We propose to utilize the IC shared information space ICS IS on INTELINK and 
implement IC access to our GLOBALREACH federated query service via accounts 

and access verified by PKI certificates. This service will provide the access requested and 
permit the auditing legally required of NS A. Further, we request that CIA forward 
PROTON data from non-SIGINT sources to NS A for inclusion in the dataset searched by 
GLOBALREACH. For data that must remain in HCS channels, we will create an HCS 
partition in FASCIA II. This will permit one-stop access to contact information for IC 
analysts. We believe that we can have GLOBALREACH available in the ICSIS shared 
space by 01 Oct 2(X)5. 

RECOMMENDATION: (FOUO) That you sign the enclosed note to the Office 
of the Director, Na tional Intelligence. Questions o f a legal nature should be directed to 
^^^^^^■AGC ( Operations), Operational question should be directed 
to^^^^^^^MSIGDEV/TAC Technical Director, 




SIGDEV/TAC TD 
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MEMORANDUM FOR THE DIRECTOR OF NATIONAL INTELLIGENCE 

SUBJECT: (U//FOUO) Sharing Communications Metadata Across the Intelligence 
Community -DECISION MEMORANDUM 



PURPOSE: (U//FOUO) To request the Director National Intelligence establish a U.S. 
Intelligence Community -wide communications metadata sharing structure; to recommend 
that the National Security Agency establish this structure along with appropriate query 
tools, training and oversight; and, that Director, NS A be designated the IC Executive 
Agent for IC-wide communications metadata. 

BACKGROUND: (S//NF) Post 91 1, the IC has increased its needs for communications 
metadata 1 . Currently, NS A collects, processes and stores vast amounts of 
communications metadata related to worldwide intelligence targets. This SIGINT 
information often includes the originator and recipient(s) identifiers, as w'ell as the date, 
time and duration of the transaction and, in some cases, locations of targets. 

(S//NF) CIA, FBI, DIA and DEA also have access to communications transaction data 
from their unique sources. These organizations, to include NS A, have benefited from 
sharing this data through the CRISSCROSS/PROTON program since 1999. Presently, 

NS A pushes roughly 60 million records per day (limited to telephony only) to PROTON, 
resulting in over 30% of the total PROTON data set. 

(S//NF) While the PROTON program has had many notable successes over the years, 
today’s environment requires that the IC implement more holistic information sharing 
and collaboration. In order to ensure the efficient and effective sharing of many millions 
of new minimized communications metadata records daily, the IC must have a new' 
sharing/collaboration structure that is scaleable to the larger IC and is capable of much 
greater volume of data. 

(S//NF) NS A stands alone in conducting metadata analysis on a large scale and as a 
result, our tools and methodologies, as w'ell as the infrastructure employed, are w'ell 
tested and have been proven efficient and effective over time. We already extensively 



1 *(C) Communications metadata refers to structured ’■‘data about data”: it includes all information 
associated with, but not including content, and includes any data used by a network, service or application 
to facilitate routing or handling of a communication or to render content in the intended format; it includes, 
but is not limited to, dialing, routing, addressing, or signaling information and data in support of various 
network management activities (e.g. billing, authentication or tracking of communicants). 
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share metadata internally within the NS A/CSS extended enterprise and with our second 
party partners. 

(S//NF) Under this proposal, IC partners would have access through NSA’s 
GLOBALREACH (the IC version will be called ICREACH) service to more than 50 
existing NS A/CSS metadata fields contained in trillions of records as well as other IC 
Agency communications metadata (predominantly resident today in PROTON). NSA’s 
throughput to ICREACH would dwarf the volume ofNSA’s present contributions to 
PROTON, as well as the input of all other IC contributors. Those fields revealing 
sources and methods or sensitive foreign relationships within metadata records would not 
be shared. Moreover, NS A is preparing to include DNI (digital network intelligence) 
data in GLOB ALREACH/IC REACH, a change that would also exponentially increase 
NSA's contributions to the IC’s communications metadata structure. 

DISCUSSION: (S//NF) NS A proposes that the DNI establish a new IC-wide 
communications metadata structure with requisite tools, training and intelligence 
oversight. This structure will consist of data repositories at various IC Agencies all 
interlinked through a web based analytic query structure via JWICS whereby IC 
personnel can make one query to access all sharable communications metadata. This 
structure will also allow IC personnel to choose the data they wish to query and the set of 
tools they desire to display and analyze the data. 

(S//NF) This structure will allow unprecedented volumes of communications metadata to 
be shared and analyzed. This structure will use the Intelligence Community Shared 
Information Space (ICSIS) carved out in Intelink and protected by community PKI access 
authorization. Having such a structure will provide the IC with access to NS A/CSS and 
other IC-element metadata, as well as the internal "federated query’ that NS A analysts 
use to correlate these information elements and enrich the results with knowledge from 
our analytic reference files and other collaboration. This proposal will address existing 
IC-wide stated needs for additional NS A communications metadata elements and take the 
IC to an unprecedented level of information sharing. 

(S//NF) This initiative is in keeping with the 9/1 1 and President’s WMD Commissions’ 
recommendations on information sharing, the President’s various Executive Orders 
related to information sharing, and your own announced goals on information sharing and 
collaboration. 

(S) This initiative was intended to facilitate a new level of sharing information across the 
IC for situational awareness, lead information, adversary analysis, and targeting and will 
add to the process of greater information sharing across the IC. 

RECOMMENDATION: (S//NF) I believe the time is right to designate an IC Executive 
Agency for sharing communications metadata as an integral part of a greater IC sharing 
environment. SIGINT metadata is a vast, rich source of information to build community 
collaboration and target knowledge and the emerging intelligence based target social 
network analysis discipline. NS A is prepared to accept this role and build the 
communications metadata coalition the IC needs for both current target tracking and 
future threat warning. 

(S//NF) To this end, my staffs have been meeting with CIA, DIA, FBI and DEA 
metadata users and technical experts to work out the details of this proposal. Once 
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approved, we will be ready to implement this structure with a roll out to these agencies 
within a few months followed by the greater IC within a year. 

DNI DECISION: 

(U//FOUO) Establish an IC-wide communications metadata structure: 

Concur 

Non-co ncur 

Other 



(U//FOUO) Designate DIRNSA/CHCSS as the U.S. IC Executive Agent for 
communications metadata: 

Concur 

Non-co ncur 

Other 



(C) My POC for this action is Deputy Chief of Staff for Operations and 

Support, Signals Intelligence Directorate, or 

nsa. ic. gov. 



KEITH B. ALEXANDER 
Lieutenant General, U.S. Army 
Director, NS A/Chief, CSS 



Cf: DoDUSD(I) 
DIR/CIA 
DIR/DIA 
DIR/FBI 
DIR/DE A 
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POINT PAPER 



22 Feb 06 



SUBJECT: CRISSCROSS/PROTON 

PURPOSE: Provide DIRNSA information on subject. 

BACKGROUND: 

(U) History of CRISSCROSS /PROTON (how did it come about, when, and by 

whom.) 

• (S//OC, NF) Project CRISSCROSS began in the early 1990's when CIA and DEA 
collaborated on a database and analytical tool suite to perform link analysis and 
cross-reference lookups against DEA and CIA collected telephone billing records 
and phone directories. 

• (S//OC, NF) NS A Office of Crime and Narcotics requested the software and 
database capabilities of CRISSCROSS to enhance SIGINT data. CRISSCROSS 
proved extremely successful at identifying new phone numbers associated with 
lost' drug targets and locating additional targets of interest. Expanding the 
coverage from Latin America to worldwide then enhanced target development 
efforts across all NS A product lines. 

(U) Current CRISSCROSS/PROTON Agreements. 

• (S//OC, NF) All CRISSCROSS/PROTON Agreements are via bilateral 
Memoranda of Understanding (MOU) and exist between CIA, DEA, NSA, DIA, 
and FBI. DEA and FBI do not currently share data with each other. 

• (S//OC, NF) DIA provides support to various DoD elements (e.g JICs/JACs and 
other Service Intelligence structures) as specified in MOU Addendums. 

(U) How current data in CRISSCROSS/PROTON is "minimized" and by what 

standards . 

• (S//OC, NF) From its inception, NSA has only provided telephony data to 
CROSSCROSS/PROTON , which constitutes : date, time, duration, called 
number and calling number. NSA 'minimizes” this metadata prior to its 
transmission of data to CIA. 

• (S//NF) NSA data is pulled from the FASCIA and HOMEBASE systems and 
transmitted to a NSA terminal in CIA's PROTON Project Office. 

• (S //SI) For U.S. and 2 rid party numbers, minimization is achieved by replacing 
the rightmost 4 digits with four x's. 
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• (S//SI) The classification of the NSA call -event records is CONFIDENTIAL 
NOFORN. 

• (S//OC, NF) NSA Office of General Counsel ruled that the data contributed by 
CIA, DIA, DEA, and FBI does not need to be minimized by NSA before being 
incorporated into the NSA PROTON system as each MO A signatory must 
"minimize" according to their own authorities. 



(U) How CRISSCROSS/PROTON operates today (data flows /tape courier, tools, etc.) 




• (S//NF) PROTON is a proprietary system architecturally inconsistent with DoD 

and NSA development guidelines and environment. It requires specific licensing 
and maintenance expenses and currently cannot be integrated with other tools . 




• (S//OC, NF) Data is transferred from NSA, DIA, and FBI to CIA electronically or 
by courier delivery of magnetic tapes. 

(U) Current proposals to modify (pending) CRISSCROSS/PROTON with the 

addition of other data elements /content/procedures 

• (S//OC, NF) New communic ations technologies necessitated evolution of the 
CRISSCROSS software. The CRISSCROSS system only handled five call -record 
fields: date, time, duration, called number and calling number. PROTON goes 
further and analyzes additional data fields that are specific to cell and satellite 
phones, such as IMEIs and IMSIs, lat/long coordinates. PROTON also analyzes 
email headers (not content), SMS text messages, SIM cards, travel records 
(passport #, flight #, description), VISA application data and excerpts from CIA 
intelligence reports . 

• (S//OC, NF) CIA, DIA, and FBI have added these additional data types to 
PROTON and share this data with NSA. However, NSA has never agreed to 
expand its contributions to PROTON. 
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• (S//QC, NF) PROTON performs entity analysis /contact chaining across data 
types. Users may search on a target entity's phone number and PROTON will 
return the associated email, cell phone, call records, street address, and CIA 
intelligence report excerpts. 

• (S//OC, NF) PROTON tools find other entities that behave in a similar manner 
to a specific target, it also identifies correspondents in common with two or more 
targets, identifies potential new phone numbers when a target switches phones, 
and identifies networks of organizations based on communications within the 
group. 

• (S//OC, NF) PROTON provides search capabilities for exploiting commercial 
phone books and data that do not conform to a particular type, such as excerpts 
from CIA intelligence reports. 

(U) Current NS A contribution to CRISSCROSS/PROTON (data elements /number of 
records to date/records per week/month, etc.) 

• (S//OC, NF) CIA, DIA, FBI, and DEA contributions over a three-month period 
totaled 11.7 billion records (which includes many records that are not 

“c ommunic ations -metadata contact records".) 

• (S//SI//NF) NSA contributions over the same three-month period totaled 4.2 
billion records (again, only limited to telephony contact data). (Note: under the 
NSA proposal to create an I C- wide communic ations metadata repository, NSA s 
contribution would be in the lOO's of billions of contact records - telephony and 
DNI contact records.) 

(U) How NSA currently uses CRISSCROSS/PROTON in conjunction with other 
NSA metadata repositories and tools . 

• (S//OC, NF) NSA analysts use Proton to perform analysis against data from 
CIA, NSA, DEA, FBI and DIA in a single common interface. Results provide 
additional targets of interest for all product lines . Merging the data produces a 
more complete picture of the target's c ommunications and activity. 

• (TS//SI//NF) NSA Users reported the following regarding the importance of 
PROTON: 

• (S) SIGINT analysts in Iraq attributed PROTON for successes at locating and 
apprehending High V alue Individuals (HVIs). PROTON had the information 
they needed to get U.S. troops in the right location. 

• (S) PROTON was critical in capturing a HVI who was wanted by the FBI and 
AFOSI for terrorist related activity in Denver. 

• (S //SI) PROTON provided the location information of a money exchange 
house that was connected to a Pakistani militant group. 
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• (S) PROTON allows a single stop to find registration information for phones 

that are not being used by the person to whom they are registered. This is 
particularly important for front companies, where tying multiple phones to 
the same registration can provide critical information/' 

(S) SID is recommending that a DNI IC-wide central communications metadata 
repository be established and reside at NSA and that DIRNSA/CHCSS be made 
Executive Agent for this IC repository. NSA and its foreign SIGINT partners stand 
alone in conducting metadata analysis on such a large scale and as a result, our 
tools and methodologies, as well as the infrastructure employed, are well tested and 
have been proven efficient and effective. We already extensively share metadata 
internally within the NSA/CSS enterprise and, having recently reached agreement 
with our Second Party partners, are ready to begin implementing that agreement to 
share Second Party metadata writ large. 

(S//NF) Rather than continuing to push communications metadata out to the 
PROTON repository, we propose using the existing IC shared information space 
ICSIS (Intelligence Community System for Information Sharing) on INTELINK and 
have IC users come in through an existing tool to pull data from metadata 
repositories resident at NSA. We would implement IC access to our 
GLOBALREACH federated query service via accounts and access verified by PKI 
certificates. This service will provide the access requested and permit the auditing 
of such repository users. We believe we can have GLOBALREACH capability ready 
for the IC within approximately one to two months of a decision to proceed with this 
proposal. 

(U//FOUO) 

for thelCmmtahntapr^osalTaiid^ 
for CRISSCROSS/PROTON, 22 Feb 06 
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(S//REL) CIA Colleagues Enthusiastically Welcome NSA Training 



FROM: (U//FOUO)^^^^^^^H 
Chief, Liaison Support Group at CIA (FBI) 

Run Date: 09/21/2010 

(S//REL) From our perspective - that of NSAers embedded within CIA's workspaces - NSA has been 
a leading proponent of information sharing within the Intelligence Community. We've seen firsthand 
how our CIA colleagues have enthusiastically embraced NSA's information-sharing initiatives, most 
recently NSA training that is contributing greatly to the development of a cadre of CIA Target Analysts 
who are capable of using SIGINT target-development information in the course of their HUMINT 
efforts. This access to select SIGINT information is invaluable to CIA. 



(S//REL) Upon joining FB's Liaison Support Group, 


recognized CIA Target Analysts' 


need for formal NSA training and arranged for E9 Technical Director 


■l^^Bto present the 



course NETA2G05 ("Introduction to Global System for Mobile Communications (GSM) and Beyond" ) 
to analysts in CIA's Crime & Narcotics Center (CNC). In addition to the introduction to GSM,^^^H 



^■■^dso presented a demonstration of the ICREACH database. ICREACH has been identified by 
the Office of the Director of National Intelligence (ODNI) as the U.S. Intelligence Community's 
standard architecture for sharing communications metadata. The database currently provides NSA and 
Second Party telephony metadata events to over 1000 analysts across 23 U.S. Intelligence Community 
agencies. 

(S//REL) The course was presented to CNC analysts on IB July 2010 and was so well received that| 
■■■immediately coordinated with^^^^^^^to schedule another offering. ■■■■ 
presented that second session in CIA's large auditorium on 9 September 2010 to approximately 100 
very engaged CIA analysts. Given this success, FB is exploring opportunities for more formal NSA 
training for our CIA customers. 

(U//FQUQ) PQCs : 

FBI Analyst/Crime & Narcotics Center, 

Technic al Director, 










